Landing Zone Architect / Lead – Azure Cloud Migration

Azure Landing Zone Architecture | VMware-to-Azure Migration | Terraform | SQL Server | Oracle | Citrix | Disaster Recovery Location: 100% Remote – Ontario/Toronto-based candidates preferred (Eastern Time Zone)

Employment Type: Contract

Contract Duration: 5 Months

Start Date: December 2026

Hours: 37.5 hours per week (7.5 hours per day)

Number of Positions: 1

Position Overview

We are seeking an experienced Azure Landing Zone Architect / Lead to support a large-scale, enterprise VMware-to-Azure migration program for a major Canadian organization.

The successful candidate will serve as the design authority for the Azure Landing Zone , ensuring the existing Terraform-based Azure environment is properly architected, extended, governed, and prepared to accommodate the migration of approximately 800 servers .

The organization already operates an Azure Landing Zone built using Terraform. This role will focus on assessing the existing environment, identifying architectural gaps, establishing remediation priorities, and designing the workload-specific landing zone patterns required to support upcoming migration waves.

Key Workloads Include

- Shared SQL Server infrastructure and database consolidation.
- Oracle-dependent enterprise applications.
- Citrix environments and potential Azure Virtual Desktop (AVD) alternatives.
- Disaster recovery and business continuity environments.

The Architect will lead a dedicated Landing Zone Engineer, provide technical direction, review designs and Infrastructure as Code, and personally lead the most complex architectural components. This position requires close collaboration with enterprise cloud architects, security and networking teams, third-party providers, and Microsoft's migration team to ensure landing zone readiness aligns with migration schedules.

Key Responsibilities

Azure Landing Zone Architecture & Governance
- Assess the existing Azure Landing Zone against the Microsoft Cloud Adoption Framework (CAF) and Azure Landing Zone reference architecture.
- Identify architectural and operational gaps and develop a prioritized remediation backlog aligned with migration waves.

- Own architectural decisions covering
- Management group and subscription hierarchy.
- Landing zone archetypes and workload placement.
- Environment segregation across Development, SIT, UAT, and Production.
- Virtual Network (VNet) sizing and network standards.
- Establish and maintain Azure governance standards, including:
- Azure Policy.
- Naming conventions and tagging standards.
- Diagnostic settings and monitoring requirements.
- Integration with Azure Log Analytics and Microsoft Sentinel.
- Ensure landing zone architecture is scalable, secure, maintainable, and aligned with enterprise standards.

Azure Networking & Security Architecture
- Design enterprise Azure networking patterns using a hub-and-spoke topology.
- Establish network connectivity and traffic management standards covering:
- VNet peering and centralized network routing.
- Palo Alto firewall integration and traffic inspection.
- Azure Application Gateway and Web Application Firewall (WAF).
- DNS and Private DNS.
- ExpressRoute and VPN connectivity.
- Private endpoints and secure service connectivity.
- Collaborate with security teams to establish identity and access management standards using:
- Microsoft Entra ID.
- Azure Role-Based Access Control (RBAC).
- Management group and subscription-level permissions.
- Managed identities.
- Ensure appropriate network isolation, security controls, and environment segregation for migrated workloads.

SQL Server & Oracle Workload Landing Zones
- Architect the shared SQL Server Landing Zone (SQL Farm) to support consolidation of migrated databases.
- Define SQL infrastructure patterns covering:
- High availability.
- Backup and recovery.
- SQL Server disaster recovery.
- Network connectivity and workload integration.
- Design Azure landing zone patterns supporting applications dependent on Oracle databases, including:
- Oracle hosted on Azure Virtual Machines.
- Oracle Database@Azure.
- Network connectivity and routing.
- DNS integration.
- Identity and access requirements.
- Environment separation.

Important:



This role focuses on enabling and architecting the Azure infrastructure supporting Oracle-dependent workloads. The client's internal team retains responsibility for the Oracle database platform itself. Oracle database administration or direct Oracle platform ownership is not required. Citrix & Azure Virtual Desktop Architecture

- Design Azure landing zone patterns for Citrix-dependent applications and workloads.

- Define architecture supporting
- Citrix Virtual Apps and Desktops.
- Citrix DaaS.
- NetScaler placement and integration.
- Network traffic flow through centralized hub infrastructure.
- Collaborate with stakeholders to assess Azure Virtual Desktop (AVD) as a potential alternative to existing Citrix environments.

Disaster Recovery & Business Continuity
- Develop standardized Azure disaster recovery architecture and deployment patterns.
- Define disaster recovery archetypes covering:
- Paired Azure regions.
- Azure Site Recovery (ASR).
- Backup policies and recovery requirements.
- Network connectivity between primary and recovery environments.
- Ensure disaster recovery landing zones are designed and available before the corresponding application migration waves.

Terraform, Infrastructure as Code & DevOps
- Establish and maintain Terraform engineering standards across the landing zone workstream.

- Define and oversee
- Terraform repository and module structure.
- Remote state management.
- Provider and module version pinning.
- Infrastructure deployment standards.
- Pull request review and approval processes.
- Implement Infrastructure as Code deployment practices using GitHub and GitHub Actions, including controlled production deployments.
- Define processes for bringing migrated Azure Virtual Machines under Terraform management following migration cutover.
- Ensure deployed infrastructure remains manageable, repeatable, and governed through code.
- Review Terraform code and architecture produced by the Landing Zone Engineer.

Technical Leadership & Migration Coordination
- Provide day-to-day technical leadership and direction to a dedicated Landing Zone Engineer.
- Review architectural designs, Terraform code, and implementation approaches to maintain engineering quality.
- Personally lead complex architectural design and engineering activities.
- Work closely with the enterprise architecture team, Microsoft's migration factory, and third-party network and security providers.
- Align landing zone readiness and infrastructure dependencies with scheduled migration waves.
- Present architectural designs, recommendations, and decisions to architecture review boards and change advisory boards (CAB).
- Document design decisions, architectural trade-offs, and implementation standards.
- Identify and escalate technical risks, dependencies, and potential migration blockers to program leadership.

Required Qualifications & Experience Azure Architecture & Enterprise Cloud Platforms

- 8+ years of experience in infrastructure engineering, cloud engineering, or related technical disciplines.
- Minimum 4 years designing Azure platforms for enterprise organizations.
- Demonstrated experience designing or substantially extending at least one production Azure Landing Zone aligned with the Microsoft Cloud Adoption Framework in a shared enterprise platform environment.

- Robust understanding of
- Azure management groups and subscription architecture.
- Azure Landing Zone archetypes.
- Azure Policy and enterprise governance.
- Microsoft Entra ID.
- Azure RBAC and identity management.
- Experience preparing Azure Landing Zones for large-scale enterprise migrations, preferably VMware-to-Azure, with infrastructure readiness aligned to migration waves.

Azure Networking
- Advanced experience designing and implementing enterprise Azure networking, including:
- Hub-and-spoke architectures.
- VNet peering.
- User-defined routes (UDRs).
- Network Security Groups (NSGs).
- Private endpoints and Private DNS.
- ExpressRoute and VPN connectivity.




- Experience integrating third-party network virtual appliances, preferably Palo Alto, into Azure environments.
- Strong understanding of traffic routing through network appliances, including troubleshooting asymmetric routing.
- Enterprise IP address planning experience.
- Familiarity with Infoblox or comparable DNS/IP Address Management (IPAM) platforms is an asset.

Enterprise Workload Landing Zones
- Experience designing Azure Landing Zones supporting enterprise database workloads, including:
- SQL Server on Azure Virtual Machines.
- Azure SQL Managed Instance.
- High availability and disaster recovery architectures.
- Experience enabling Oracle-dependent workloads on Azure, including Oracle on Azure VMs or Oracle Database@Azure, with emphasis on networking, identity, and application integration.
- Experience designing or deploying Citrix environments in Azure, including Citrix Virtual Apps and Desktops, Citrix DaaS, and NetScaler, or Azure Virtual Desktop (AVD).
- Experience designing Azure disaster recovery solutions using Azure Site Recovery and paired-region architectures.

Terraform & Infrastructure Engineering
- Strong hands-on production experience with Terraform on Azure, including:
- AzureRM and AzAPI providers.
- Terraform module design and reuse.
- Remote state management using Azure Storage with state locking.
- Provider and module version pinning.
- Importing existing Azure resources into Terraform management.
- Experience using Azure Verified Modules (AVM) or Azure Landing Zone Terraform modules.
- Experience implementing Infrastructure as Code CI/CD pipelines using GitHub and GitHub Actions.

- Familiarity with
- Terraform plan reviews through pull requests.
- Environment approvals.
- Controlled production deployments.
- Proficiency with PowerShell and Azure CLI.

Leadership, Communication & Education
- Demonstrated experience leading engineers within an Azure platform, cloud infrastructure, or landing zone workstream.
- Ability to provide technical oversight, review code and architecture, and maintain engineering quality standards.
- Strong communication skills, with the ability to explain complex architectural decisions and trade-offs to technical teams, security stakeholders, enterprise architects, and senior leadership.
- Experience documenting architectural decisions and technical recommendations.
- Comfortable operating within formal enterprise change management processes, including:
- Change Advisory Board (CAB) submissions.
- Scheduled change windows.
- Coordination with operations teams and third-party service providers.
- Post-secondary degree in Computer Science, Information Systems, Engineering, or a related technical discipline.

Nice-to-Have Qualifications

- Experience with Azure Bicep.
- Hands-on deployment experience with Oracle Database@Azure.
- Experience planning or executing Citrix-to-Azure Virtual Desktop migrations.
- Familiarity with Microsoft Sentinel, Microsoft Defender for Cloud, and Azure Virtual Network Manager.
- Previous experience supporting Canadian public-sector organizations.
- Relevant professional certifications, including:
- Microsoft Certified: Azure Solutions Architect Expert (AZ-305).
- Microsoft Certified: Azure Network Engineer Associate (AZ-700).
- HashiCorp Certified: Terraform Associate.

Ideal Candidate Profile The ideal candidate is a hands-on Azure Landing Zone Architect with strong Terraform engineering expertise , capable of taking ownership of an existing enterprise Azure Landing Zone and extending it to support a complex, large-scale migration program. This individual should bring proven experience in Azure platform architecture, enterprise networking, workload landing zone design, and Infrastructure as Code, along with the technical leadership skills necessary to guide engineering resources and make critical architectural decisions.

Particular consideration will be given to candidates who have supported large-scale VMware-to-Azure migrations , designed shared SQL Server and Oracle-dependent workload environments, and worked with Citrix, Azure Virtual Desktop, and enterprise disaster recovery architectures.

The successful candidate must be comfortable balancing strategic architecture ownership with hands-on technical involvement, while ensuring infrastructure readiness remains aligned with aggressive migration schedules.

,

📌 Landing Zone Architect Lead – Azure Cloud Migration (36171) (Ontario)
🏢 Myticas Consulting
📍 Ontario